flux fleet digest — 2026-10-14 07:34 UTC
Fleet overview (last 24h vs 7-day baseline)
| sensor |
events |
uniq IPs |
7d avg events |
7d avg uniq |
events delta |
| ai-devbox-1 |
1290 |
206 |
1860 |
130 |
-31% |
| canary-farm-1 |
2683 |
322 |
2328 |
171 |
+15% |
| control-1 |
3578 |
105 |
3230 |
121 |
+11% |
| frantech-ts |
14216 |
76 |
14699 |
81 |
-3% |
| lauterbourg-01-ts |
2240 |
155 |
1621 |
146 |
+38% |
| netcup-ts |
5114 |
102 |
1901 |
98 |
+169% |
| ru-edge-1 |
4158 |
106 |
1822 |
124 |
+128% |
| sponge-01-ts |
3697 |
113 |
1515 |
94 |
+144% |
Sensors discovered in the sink: ai-devbox-1, canary-farm-1, control-1, frantech-ts, lauterbourg-01-ts, netcup-ts, ru-edge-1, sponge-01-ts.
Result-tag spikes (campaign candidates)
| sensor |
result |
24h |
7d avg |
ratio |
| ai-devbox-1 |
wp-login-credentials |
79 |
19.2 |
4.1x |
| ai-devbox-1 |
wp-login-probe |
164 |
32.8 |
5.0x |
| canary-farm-1 |
wp-admin-redirect |
44 |
3.5 |
12.6x |
| canary-farm-1 |
wp-rest-auth-required |
39 |
6.0 |
6.5x |
| lauterbourg-01-ts |
phpmyadmin-login |
304 |
57.8 |
5.3x |
| netcup-ts |
tarpit-module |
4460 |
1195.1 |
3.7x |
| ru-edge-1 |
app-config-php |
50 |
13.2 |
3.8x |
| ru-edge-1 |
app-config-python |
56 |
15.8 |
3.6x |
| ru-edge-1 |
application-properties |
22 |
5.5 |
4.0x |
| ru-edge-1 |
fake-git |
191 |
44.4 |
4.3x |
| ru-edge-1 |
phpmyadmin-login |
45 |
9.8 |
4.6x |
| ru-edge-1 |
terraform-tfstate |
21 |
5.8 |
3.6x |
| ru-edge-1 |
webapp-config-bundle-js |
49 |
13.2 |
3.7x |
Campaign clusters (24h, journey-fingerprinted)
| signature |
IPs |
events |
sensors |
first seen |
sample journey (6 steps) |
| e6e6f15a77e8 ⟳ |
196 |
588 |
ai-devbox-1,canary-farm-1 ⚠FLEET-WIDE |
09-03 |
/wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] |
| 3e1c5eb879e7 ⟳ |
85 |
595 |
ai-devbox-1,canary-farm-1,control-1,frantech-ts,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
08-29 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] |
| 09d3f351065c |
21 |
168 |
ai-devbox-1,canary-farm-1 ⚠FLEET-WIDE |
10-14 |
/wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] → /wp-admin/profile.php [wp-admin-redirect] → /wp-login.php [wp-login-probe] → /wp-admin/ [wp-admin-redirect] → /wp-login.php [wp- |
| 7e61a9500d8b ⟳ |
12 |
588 |
ai-devbox-1,canary-farm-1,control-1,frantech-ts,netcup-ts,sponge-01-ts ⚠FLEET-WIDE |
08-29 |
/bin/sh [cgi-traversal-rce-command] → /bin/sh [cmd-injection-apache-cgi-shell] → /hello.world [cmd-injection-php-cgi-rce] → / [cmd-injection-php-cgi-rce] → /index.php [cmd-injection-php-cgi-rce] → /te |
| ef1ab74f3d57 ⟳ |
7 |
343 |
ai-devbox-1,canary-farm-1,control-1,frantech-ts,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
09-02 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → / [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → … |
| 218630667b2c ⟳ |
7 |
295 |
ai-devbox-1,canary-farm-1,control-1,frantech-ts,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
09-02 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → / [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → … |
| 850993125b15 ⟳ |
6 |
246 |
canary-farm-1 |
08-29 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → … |
| 7ea1125e0232 ⟳ |
5 |
70 |
canary-farm-1,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
08-30 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → / [tarpit-module] → / [tarpit] → / [tarpit-disconnect] |
Signature = SHA-256 of the ordered path[result] sequence (≤40 steps). Same signature across IPs = one tooling campaign; IPs rotate, signatures persist.
First-seen in this window
New paths:
| sensor |
path |
first seen |
| ru-edge-1 |
/vr5oyk7sbt1qt3u6 |
2026-10-14 03:15:39.518706-04:00 |
| ru-edge-1 |
/seed.txt |
2026-10-14 03:15:39.518706-04:00 |
| ru-edge-1 |
/api/v3/openapi.json |
2026-10-14 03:15:39.518706-04:00 |
| ru-edge-1 |
/dist/openapi.json |
2026-10-14 03:15:39.518706-04:00 |
| ru-edge-1 |
/openapi.min.json |
2026-10-14 03:15:39.518706-04:00 |
| canary-farm-1 |
/utils/.env |
2026-10-14 03:15:39.518706-04:00 |
| canary-farm-1 |
/.env.ses |
2026-10-14 03:15:39.518706-04:00 |
| canary-farm-1 |
/config/environment.json |
2026-10-14 03:15:39.518706-04:00 |
| canary-farm-1 |
/*.auto.tfvars |
2026-10-14 03:15:39.518706-04:00 |
| canary-farm-1 |
/.terraform.rc |
2026-10-14 03:15:39.518706-04:00 |
| control-1 |
/.dockerconfigjson |
2026-10-14 03:15:39.518706-04:00 |
| control-1 |
/config_freqtrade.json |
2026-10-14 03:15:39.518706-04:00 |
| control-1 |
/metamask-vault.json |
2026-10-14 03:15:39.518706-04:00 |
| control-1 |
/hummingbot.yml |
2026-10-14 03:15:39.518706-04:00 |
| lauterbourg-01-ts |
/hosts.yml |
2026-10-14 03:15:39.518706-04:00 |
| lauterbourg-01-ts |
/site.zip |
2026-10-14 03:15:39.518706-04:00 |
| lauterbourg-01-ts |
/tests/ |
2026-10-14 03:15:39.518706-04:00 |
| lauterbourg-01-ts |
/configuration.yaml |
2026-10-14 03:15:39.518706-04:00 |
| lauterbourg-01-ts |
/sql/phpmy-admin/index.php |
2026-10-14 03:15:39.518706-04:00 |
| netcup-ts |
/livewire/update |
2026-10-14 03:15:39.518706-04:00 |
New user agents:
| sensor |
user agent |
first seen |
| canary-farm-1 |
Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like |
2026-10-14 03:34:27.295253-04:00 |
| ru-edge-1 |
Mozilla/5.0 (Knoppix; Linux x86_64) AppleWebKit/537.36 (KHTM |
2026-10-14 03:15:40.955167-04:00 |
| ru-edge-1 |
Mozilla/5.0 (ZZ; Linux x86_64) AppleWebKit/537.36 (KHTML, li |
2026-10-14 03:15:40.955167-04:00 |
| ru-edge-1 |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/ |
2026-10-14 03:15:40.955167-04:00 |
| ru-edge-1 |
Mozilla/5.0 (Kubuntu; Linux x86_64) AppleWebKit/537.36 (KHTM |
2026-10-14 03:15:40.955167-04:00 |
| ru-edge-1 |
Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:127.0) Gecko/2010 |
2026-10-14 03:15:40.955167-04:00 |
| sponge-01-ts |
Mozilla/5.0 (iPhone; CPU iPhone OS 15_3 like Mac OS X) Apple |
2026-10-14 03:15:40.955167-04:00 |
| sponge-01-ts |
Mozilla/5.0 (ZZ; Linux i686) AppleWebKit/537.36 (KHTML, like |
2026-10-14 03:15:40.955167-04:00 |
| canary-farm-1 |
Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) Ap |
2026-10-14 03:15:40.955167-04:00 |
| canary-farm-1 |
Mozilla/5.0 (compatible; Meta-ExternalFetcher/1.0; +https:// |
2026-10-14 03:15:40.955167-04:00 |
Top talkers (24h)
| sensor |
IP |
events |
trap fams |
paths |
first |
last |
blocklist |
ASN org |
cc |
POSTed |
| frantech-ts |
185.209.196.130 |
13565 |
5 |
13565 |
10-14 02:10 |
10-14 02:12 |
ipsum:2 |
31173 Services AB |
DE |
0 |
| ru-edge-1 |
87.120.104.29 |
3000 |
140 |
1642 |
10-13 11:39 |
10-13 19:31 |
- |
Sino Worldwide Trading Limit |
NO |
0 |
| netcup-ts |
185.73.23.161 |
2095 |
3 |
19 |
10-13 03:36 |
10-14 03:28 |
- |
Ruhr-Universitaet Bochum |
DE |
0 |
| control-1 |
204.76.203.18 |
2082 |
2 |
578 |
10-13 03:35 |
10-14 06:09 |
ipsum:2 |
Pfcloud UG (haftungsbeschran |
NL |
0 |
| netcup-ts |
185.73.23.162 |
1965 |
3 |
10 |
10-13 14:33 |
10-14 06:11 |
- |
Ruhr-Universitaet Bochum |
DE |
0 |
| sponge-01-ts |
185.73.23.162 |
1803 |
3 |
9 |
10-13 14:32 |
10-14 06:13 |
- |
Ruhr-Universitaet Bochum |
DE |
0 |
| sponge-01-ts |
185.73.23.161 |
959 |
2 |
9 |
10-13 03:43 |
10-13 23:56 |
- |
Ruhr-Universitaet Bochum |
DE |
0 |
| lauterbourg-01-ts |
163.192.99.99 |
853 |
22 |
788 |
10-13 23:08 |
10-13 23:09 |
- |
Oracle Corporation |
US |
0 |
| canary-farm-1 |
35.253.66.111 |
650 |
64 |
310 |
10-13 10:37 |
10-13 10:37 |
- |
Google LLC |
US |
41 |
| ai-devbox-1 |
103.214.20.135 |
309 |
22 |
55 |
10-14 01:12 |
10-14 05:48 |
- |
Host Universal Pty Ltd |
AU |
30 |
| canary-farm-1 |
103.214.20.135 |
299 |
22 |
55 |
10-14 02:58 |
10-14 05:25 |
- |
Host Universal Pty Ltd |
AU |
30 |
| lauterbourg-01-ts |
185.177.72.64 |
258 |
7 |
254 |
10-14 04:54 |
10-14 04:56 |
ipsum:1 |
Bucklog SARL |
FR |
0 |
| control-1 |
45.148.10.238 |
179 |
11 |
68 |
10-13 04:39 |
10-13 04:42 |
ipsum:3 firehol2 |
Techoff Srv Limited |
NL |
16 |
| ru-edge-1 |
159.26.110.149 |
163 |
48 |
96 |
10-13 13:14 |
10-13 14:26 |
- |
Proton AG |
PL |
0 |
| netcup-ts |
161.178.140.14 |
163 |
12 |
53 |
10-14 02:03 |
10-14 02:06 |
- |
Amazon.com, Inc. |
US |
12 |
Canary economics (24h)
| sensor |
mints |
distinct minting IPs |
| control-1 |
10 |
8 |
| ai-devbox-1 |
16 |
10 |
| canary-farm-1 |
62 |
13 |
| ru-edge-1 |
19 |
8 |
| netcup-ts |
0 |
0 |
| sponge-01-ts |
0 |
0 |
Mint failures (24h): ru-edge-1:?x1
Mints by type label:
| sensor |
types |
mints |
| ai-devbox-1 |
["aws"] |
16 |
| canary-farm-1 |
["aws"] |
62 |
| control-1 |
["aws"] |
10 |
| ru-edge-1 |
["aws"] |
19 |
XFF forgery signals (24h)
- requests with any X-Forwarded-For: 2396
- multi-entry XFF (forged chains — no proxy appends on the direct path): 0
- XFF present but ignored as the source (all entries internal, or it agrees with the peer): 324
- XFF naming a source other than the socket peer, from a direct connection (single-entry forgery): 0
TLS split + Host census (24h)
| sensor |
protocol |
events |
| ai-devbox-1 |
http |
827 |
| ai-devbox-1 |
https |
463 |
| canary-farm-1 |
https |
1453 |
| canary-farm-1 |
http |
1230 |
| control-1 |
http |
3578 |
| frantech-ts |
http |
14216 |
| lauterbourg-01-ts |
http |
2084 |
| lauterbourg-01-ts |
https |
156 |
| netcup-ts |
http |
5114 |
| ru-edge-1 |
http |
4158 |
| sponge-01-ts |
http |
3697 |
Top Host headers:
| sensor |
host |
events |
| frantech-ts |
209.141.62.110 |
14207 |
| ru-edge-1 |
130.94.89.46 |
4155 |
| control-1 |
38.54.2.209 |
3567 |
| lauterbourg-01-ts |
89.116.25.211 |
1977 |
| canary-farm-1 |
sso.rightabouteverything.show |
1660 |
| netcup-ts |
159.195.21.150 |
1045 |
| canary-farm-1 |
109.123.246.142 |
1015 |
| sponge-01-ts |
89.167.72.144 |
931 |
| ai-devbox-1 |
inference.fapthropic.com |
671 |
| ai-devbox-1 |
217.15.163.226 |
604 |
Control node discovery velocity
- first event ever: 2026-09-12 07:59 UTC (31 days live)
- daily unique-IP ramp (newest first):
| day |
events |
uniq IPs |
| 2026-10-14 |
3578 |
105 |
| 2026-10-13 |
4659 |
109 |
| 2026-10-12 |
3089 |
115 |
| 2026-10-11 |
1641 |
111 |
| 2026-10-10 |
4416 |
123 |
| 2026-10-09 |
3138 |
114 |
| 2026-10-08 |
3354 |
146 |
| 2026-10-07 |
2313 |
126 |
| 2026-10-06 |
3132 |
154 |
| 2026-10-05 |
2928 |
133 |
| 2026-10-04 |
4542 |
157 |
| 2026-10-03 |
2899 |
128 |
| 2026-10-02 |
2751 |
115 |
| 2026-10-01 |
3962 |
117 |
Kill-chain watchlist (24h)
| sensor |
IP |
trap fams |
journey (chronological) |
ASN org |
cc |
| ru-edge-1 |
87.120.104.29 |
140 |
/.env.tmp [env-production] → /.env.save [env-production] → /.env.saved [env-production] → /public/.env [env-production] → /src/.env [env-production] → /web/.env.local [env-production] → /client/.env.local [env-production] → /env [actuator-env] → /.env_dev [env-production] → /.env.1 [tarpit-module] → /api/.env.local [env-production] → /.env.template [env-production] |
Sino Worldwide Trading Limit |
NO |
| canary-farm-1 |
35.253.66.111 |
64 |
/ [tarpit-module] → /robots.txt [tarpit-module] → /hrx10uar7ad9h24cpkpg [not-handled] → /h9zd41s557mvglr4w7sb [not-handled] → /z9x8c7v6b5-debug-trigger-sso.rightabouteverything.show [not-handled] → /compose.yml [docker-compose] → /docker-compose.yml [docker-compose] → /.env.supabase [tarpit-module] → /graphql [graphql-introspection] → /key.json [firebase-json] → /compose.yaml [docker-compose] → /.github/workflows/deploy.yml [github-actions-workflow] |
Google LLC |
US |
| control-1 |
159.26.110.149 |
48 |
/ [tarpit-module] → / [tarpit] → /.env.prod [env-production] → /.env [issued] → /.env.production [env-production] → /.git/config [fake-git] → /.aws/credentials [aws-credentials-file] → /.ssh/id_rsa [ssh-private-key-error] → /wp-config.php [wp-config] → /config.json [config-json] → /appsettings.json [appsettings-json] → /.htpasswd [htpasswd-error] |
Proton AG |
PL |
| ru-edge-1 |
159.26.110.149 |
48 |
/ [tarpit-module] → / [tarpit] → /.env.production [env-production] → /.env [tracebit-error] → /.env.prod [env-production] → /.aws/credentials [aws-credentials-file] → /.git/config [fake-git] → /.ssh/id_rsa [ssh-private-key-error] → /wp-config.php [wp-config] → /config.json [config-json] → /appsettings.json [appsettings-json] → /terraform.tfstate [terraform-tfstate] |
Proton AG |
PL |
| ai-devbox-1 |
64.227.32.66 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
GB |
| canary-farm-1 |
206.189.95.232 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
SG |
| canary-farm-1 |
206.189.233.36 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
| ru-edge-1 |
143.244.168.161 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
| canary-farm-1 |
157.245.204.205 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
SG |
| control-1 |
159.89.12.166 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| canary-farm-1 |
167.99.182.39 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
CA |
| ru-edge-1 |
146.190.63.248 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
| ai-devbox-1 |
139.59.132.8 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| ai-devbox-1 |
142.93.0.66 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
US |
| control-1 |
146.190.242.161 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
CA |
SSH/telnet honeypot (single sensor: frantech-ts)
Own honeypots on :2222/:2323, not the flux trap surface. Condensed feed (/data/hp-logs/), deliberately not part of v_logs. One host, so read it as a single-sensor view, not a fleet number.
- funnel: 489 sources sent credentials → 327 got a shell (67%) → 253 ran a command (77% of shell-getters, 52% of sources)
- event level: 15380 credential attempts → 2697 accepted logins → 4569 commands (169% of accepted logins go on to run something)
- telnet (commodity IoT botnets): 2628 attempts
New commands this window (0 of 42 distinct):
no command seen for the first time this window
Recurring commands (⟳ seen in an earlier window):
| events |
IPs |
example source |
command (head) |
| 861 |
173 |
106.13.190.191 |
"cd ~; chattr -ia .ssh; lockr -ia .ssh" |
| 766 |
158 |
200.219.200.16 |
"cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0b |
| 273 |
5 |
45.148.10.61 |
"/bin/./uname -s -v -n -r -m" |
| 273 |
5 |
45.148.10.61 |
"nvidia-smi -q | grep "Product Name" | head -n 1 | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}'" |
| 273 |
5 |
45.148.10.61 |
"lspci | grep VGA -c" |
| 273 |
5 |
45.148.10.61 |
"uptime -p" |
| 273 |
5 |
45.148.10.61 |
"lspci | grep VGA | cut -f5- -d ' '" |
| 273 |
5 |
45.148.10.61 |
"lspci | grep "3D controller" | cut -f5- -d ' '" |
Credentials: 9490 distinct pairs offered this window, 0 new. Concentration is the signal, not the list — top pairs:
| attempts |
user |
password |
| 829 |
345gs5662d34 |
345gs5662d34 |
| 626 |
root |
3245gs5662d34 |
| 56 |
user |
wasd |
| 55 |
root |
123456 |
| 48 |
pi |
raspberry |
| 41 |
admin |
3245gs5662d34 |
| 31 |
ubuntu |
3245gs5662d34 |
| 29 |
support |
support |